CVE-2024-2947

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-2947
A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2024-2947
https://bugzilla.redhat.com/show_bug.cgi?id=2271614
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KNG7GXOZI6QH3OIQJYAYDB3CRRGH37Q5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N3Q5SDIFACAY4VHACN5MMCMT3A53A3FB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PIQY2HGDJW2JY27ALTS4GEVZZJJ4XQ36/
Configurations

No configuration.

History

18 Apr 2024, 02:15

Type Values Removed Values Added
Summary
  • (es) Se encontró una falla en Cockpit. Eliminar un informe sos con un nombre modificado a través de la interfaz web de Cockpit puede generar una vulnerabilidad de inyección de comandos, lo que resulta en una escalada de privilegios. Este problema afecta a las versiones 270 y posteriores de Cockpit.
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N3Q5SDIFACAY4VHACN5MMCMT3A53A3FB/ -

31 Mar 2024, 02:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KNG7GXOZI6QH3OIQJYAYDB3CRRGH37Q5/ -

30 Mar 2024, 02:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PIQY2HGDJW2JY27ALTS4GEVZZJJ4XQ36/ -

28 Mar 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-28 19:15

Updated : 2024-04-18 02:15

NVD link : CVE-2024-2947

Mitre link : CVE-2024-2947

CVE.ORG link : CVE-2024-2947

JSON object : View

Products Affected

No product.

CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')